Categories: Malware

Graftor.404654 malicious file

The Graftor.404654 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Graftor.404654 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Reads data out of its own binary image
Performs some HTTP requests
Unconventionial language used in binary resources: Marathi
Uses Windows utilities for basic functionality
Creates a hidden or system file
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

persist.tippled.ru

appcat.centralus.cloudapp.azure.com

www.bing.com

How to determine Graftor.404654?


File Info:
crc32: 6FAC9969md5: 71c03d6bd33896c277e45ffdd9dd6cd3name: 71C03D6BD33896C277E45FFDD9DD6CD3.mlwsha1: f96b949253fca256bd2cc8627db86e6864b01e69sha256: dd28e3f84e83d411471cbe4a35f10e5e08c6ce3c9279171a63cf565ac4773dd6sha512: 595b6c7aa18c332b06e9d1d15d9c40389b85f48c55e6d66000dfec66cb704c8365f65b17b523e8ff1456ce8cae9a532c9ba631b0210be6cf1e14ee51fa010da7ssdeep: 3072:ZkAeFJqSZDPGY4w5ZfAJOQVkh6ohKKCaCGzZWY8UzKAg0Fujz4MoXN2ACc1BSGbW:Ctmw5VA1VbK5rKAOL8xCiBYtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: xLxf6aderInternalName: xLxf6aderFileVersion: 198.2430.230.10CompanyName: xLxf6aderProductName: xLxf6aderProductVersion: 1.0.0.13FileDescription: xLxf6aderOriginalFilename: xLxf6aderTranslation: 0x0413 0x04b0

Graftor.404654 also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Graftor.404654
FireEye	Generic.mg.71c03d6bd33896c2
CAT-QuickHeal	Trojan.Wacatac
ALYac	Gen:Variant.Graftor.404654
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan-Downloader ( 0051500f1 )
BitDefender	Gen:Variant.Graftor.404654
K7GW	Trojan-Downloader ( 0051500f1 )
Cybereason	malicious.bd3389
BitDefenderTheta	Gen:NN.ZexaF.34804.@D2@aSekBkbG
Cyren	W32/S-18269d4e!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	Win32/TrojanDownloader.Tovkater.CG
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	not-a-virus:HEUR:AdWare.Win32.Generic
NANO-Antivirus	Riskware.Win32.TOVus.esasxd
Tencent	Malware.Win32.Gencirc.10b4af55
Ad-Aware	Gen:Variant.Graftor.404654
Emsisoft	Gen:Variant.Graftor.404654 (B)
Comodo	ApplicUnwnt@#3mwg4j0g2xl6d
F-Secure	Adware.ADWARE/Adware.Gen7
DrWeb	Trojan.InstallMonster.2327
Zillya	Downloader.Tovkater.Win32.390
TrendMicro	HT_TOVKATER_GI080235.UVPM
McAfee-GW-Edition	BehavesLike.Win32.Generic.tz
Sophos	Generic PUA PJ (PUA)
SentinelOne	Static AI – Malicious PE
Jiangmin	AdWare.TOVus.ag
MaxSecure	Win.MxResIcn.Heur.Gen
Avira	ADWARE/Adware.Gen7
MAX	malware (ai score=89)
Antiy-AVL	GrayWare[AdWare]/Win32.TOVus
Microsoft	PUA:Win32/Bitrepeyp.C
Arcabit	Trojan.Graftor.D62CAE
SUPERAntiSpyware	Adware.InstallMonster/Variant
AhnLab-V3	PUP/Win32.InstallMonster.R207267
ZoneAlarm	not-a-virus:HEUR:AdWare.Win32.Generic
GData	Gen:Variant.Graftor.404654
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	GenericRXCK-UX!71C03D6BD338
VBA32	BScope.Trojan.InstallMonster
Malwarebytes	Generic.Trojan.Injector.DDS
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	HT_TOVKATER_GI080235.UVPM
Rising	Trojan.Generic@ML.100 (RDMK:oL23ON62fgvHichu/Bf8Yg)
Yandex	Trojan.GenAsa!KuwrdL+EQU8
Ikarus	Trojan-Downloader.Win32.Tovkater
eGambit	Unsafe.AI_Score_98%
Fortinet	W32/Tovkater.CG!tr.dldr
Webroot	W32.Malware.Gen
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	HEUR/QVM10.1.5106.Malware.Gen